Suspicious network traffic.

I have a RedHat 9.0 linux server. It's a development server, has not
been announced to public, and only contains common services (apache
httpd, ssh, pure-ftpd, sendmail).

Recently, I installed mrtg to see its eth0 traffic.

From mrtg, I found a constant 2 MBytes "incoming" traffic coming into
eth0 every 5 minutes.

Then I verified this by executing "ifconfig eth0" several times, and I
noticed that the RX value is increased a lot.

So, I wondering where this traffic coming from?

I run "tcpdump -i eth0", but ... I saw no strange traffic, its quiet
.... not so much traffic.

How can I debug/fix this problem? I need to know why this eth0 RX
value increased about 2 MBytes every 5 minutes ...

Anyone know how to trace this problem?

In article <(E-Mail Removed) > moorhuhn <(E-Mail Removed)> wrote:

>From mrtg, I found a constant 2 MBytes "incoming" traffic coming into
>eth0 every 5 minutes.
[...]
>How can I debug/fix this problem? I need to know why this eth0 RX
>value increased about 2 MBytes every 5 minutes ...
>
>Anyone know how to trace this problem?

Install and use http://freshmeat.net/projects/iftop/ to see what's happening.


tony

--
use hotmail for any email replies


-----= Posted via Newsfeeds.Com, Uncensored Usenet News =-----
http://www.newsfeeds.com - The #1 Newsgroup Service in the World!
-----== Over 100,000 Newsgroups - 19 Different Servers! =-----